ClickHouse/docs/en/operations/access-rights.md

toc_priority	toc_title
48	Access Control and Account Management

Access Control and Account Management

ClickHouse supports access control management based on RBAC approach.

ClickHouse access entities:

• User account
• Role
• Row Policy
• Settings Profile
• Quota

You can configure access entities using:

• SQL-driven workflow.

  You need to enable this functionality.

• Server configuration files users.xml and config.xml.

We recommend using SQL-driven workflow. Both of the configuration methods work simultaneously, so if you use the server configuration files for managing accounts and access rights, you can softly move to SQL-driven workflow.

!!! note "Warning" You can't manage the same access entity by both configuration methods simultaneously.

Usage

By default, the ClickHouse server provides the user account default which is not allowed using SQL-driven access control and account management but have all the rights and permissions. The default user account is used in any cases when the username is not defined, for example, at login from client or in distributed queries. In distributed query processing a default user account is used, if the configuration of the server or cluster doesn’t specify the user and password properties.

If you just start using ClickHouse, you can use the following scenario:

1. Enable SQL-driven access control and account management for the default user.
2. Login under the default user account and create all the required users. Don't forget to create an administrator account (GRANT ALL ON *.* WITH GRANT OPTION TO admin_user_account).
3. Restrict permissions for the default user and disable SQL-driven access control and account management for it.

Properties of Current Solution

• You can grant permissions for databases and tables even if they are not exist.
• If a table was deleted, all the privileges that correspond to this table are not revoked. So, if a new table is created later with the same name all the privileges become again actual. To revoke privileges corresponding to the deleted table, you need to perform, for example, the REVOKE ALL PRIVILEGES ON db.table FROM ALL query.
• There is no lifetime settings for privileges.

User account

A user account is an access entity that allows to authorize someone in ClickHouse. A user account contains:

• Identification information.
• Privileges that define a scope of queries the user can perform.
• Hosts from which connection to the ClickHouse server is allowed.
• Granted and default roles.
• Settings with their constraints that apply by default at the user's login.
• Assigned settings profiles.

Privileges to a user account can be granted by the GRANT query or by assigning roles. To revoke privileges from a user, ClickHouse provides the REVOKE query. To list privileges for a user, use the - SHOW GRANTS statement.

Management queries:

• CREATE USER
• ALTER USER
• DROP USER
• SHOW CREATE USER

Settings Applying

Settings can be set by different ways: for a user account, in its granted roles and settings profiles. At a user login, if a setting is set in different access entities, the value and constrains of this setting are applied by the following priorities (from higher to lower):

1. User account setting.
2. The settings of default roles of the user account. If a setting is set in some roles, then order of the setting applying is undefined.
3. The settings in settings profiles assigned to a user or to its default roles. If a setting is set in some profiles, then order of setting applying is undefined.
4. Settings applied to all the server by default or from the default profile.

Role

Role is a container for access entities that can be granted to a user account.

Role contains:

• Privileges
• Settings and constraints
• List of granted roles

Management queries:

• CREATE ROLE
• ALTER ROLE
• DROP ROLE
• SET ROLE
• SET DEFAULT ROLE
• SHOW CREATE ROLE

Privileges to a role can be granted by the GRANT query. To revoke privileges from a role ClickHouse provides the REVOKE query.

Row Policy

Row policy is a filter that defines which or rows is available for a user or for a role. Row policy contains filters for one specific table and list of roles and/or users which should use this row policy.

Management queries:

• CREATE ROW POLICY
• ALTER ROW POLICY
• DROP ROW POLICY
• SHOW CREATE ROW POLICY

Settings Profile

Settings profile is a collection of settings. Settings profile contains settings and constraints, and list of roles and/or users to which this quota is applied.

Management queries:

• CREATE SETTINGS PROFILE
• ALTER SETTINGS PROFILE
• DROP SETTINGS PROFILE
• SHOW CREATE SETTINGS PROFILE

Quota

Quota limits resource usage. See Quotas.

Quota contains a set of limits for some durations, and list of roles and/or users which should use this quota.

Management queries:

• CREATE QUOTA
• ALTER QUOTA
• DROP QUOTA
• SHOW CREATE QUOTA

Enabling SQL-driven Access Control and Account Management

• Setup a directory for configurations storage.

  ClickHouse stores access entity configurations in the folder set in the access_control_path server configuration parameter.

• Enable SQL-driven access control and account management for at least one user account.

  By default, SQL-driven access control and account management is turned off for all users. You need to configure at least one user in the users.xml configuration file and assign 1 to the access_management setting.

Original article